quic-go has Client Crash Due to Premature HANDSHAKE_DONE Frame
Priority LOW 39CWE-617Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-617.
Summary
quic-go is an implementation of the QUIC protocol in Go. In versions prior to 0.49.0, 0.54.1, and 0.55.0, a misbehaving or malicious server can cause a denial-of-service (DoS) attack on the quic-go client by triggering an assertion failure, leading to a process crash. This requires no authentication and can be exploited during the handshake phase. This was observed in the wild with certain server implementations. quic-go needs to be able to handle misbehaving server implementations, including those that prematurely send a HANDSHAKE_DONE frame. Versions 0.49.0, 0.54.1, and 0.55.0 discard Initial keys when receiving a HANDSHAKE_DONE frame, thereby correctly handling premature HANDSHAKE_DONE frames.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Partial quic-go (quic-go): 0.49.1, 0.54.1github.com/quic-go/quic-go (Go): 0.49.1, 0.54.1Red Hat: 8 advisoriesRed Hat: 10 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| quic-go | quic-go | before 0.49.1; 0.5.0 to before 0.54.1 | 0.49.1, 0.54.1 | Patch available | CNA |
| — | github.com/quic-go/quic-go (Go) | before 0.49.1 | 0.49.1 | Patch available | GHSA-47m2-4cr7-mhcw |
| — | github.com/quic-go/quic-go (Go) | 0.50.0 to before 0.54.1 | 0.54.1 | Patch available | GHSA-47m2-4cr7-mhcw |
- quic-go Vendorquic-go Affected before 0.49.1; 0.5.0 to before 0.54.1 Fixed in 0.49.1, 0.54.1 Patch available CNA
- github.com/quic-go/quic-go (Go) Vendor— Affected before 0.49.1 Fixed in 0.49.1 Patch available GHSA-47m2-4cr7-mhcw
- github.com/quic-go/quic-go (Go) Vendor— Affected 0.50.0 to before 0.54.1 Fixed in 0.54.1 Patch available GHSA-47m2-4cr7-mhcw
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:* | — | — | Quic-go Project |
- cpe:2.3:a:quic-go_project:quic-go:*:*:*:*:*:*:*:* Versions — — ·Quic-go Project
Remediation
- Fix · CNA quic-go (quic-go) Fixed in 0.49.1, 0.54.1
- Fix · GHSA-47m2-4cr7-mhcw github.com/quic-go/quic-go (Go) Fixed in 0.49.1 Advisory →
- Fix · GHSA-47m2-4cr7-mhcw github.com/quic-go/quic-go (Go) Fixed in 0.54.1 Advisory →
Red Hat 8 advisories
- RHSA-2026:36873 Released 2026-07-08 · Red Hat rating ImportantSubmariner v0.20 security fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
- RHSA-2025:23131 Released 2025-12-11 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/eda-controller-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8 +2
- RHSA-2025:23069 Released 2025-12-10 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-automation-platform-installer-2.5-20.el8ap, ansible-builder-3.1.1-1.el8ap, ansible-creator-25.12.0-1.el8ap +47
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-automation-platform-installer-2.5-20.el9ap, ansible-builder-3.1.1-1.el9ap, ansible-creator-25.12.0-1.el9ap +47
Show 5 more Red Hat advisories
- RHSA-2025:22784 Released 2025-12-04 · Red Hat rating ModerateSubmariner v0.22 security fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9
- RHSA-2025:21892 Released 2025-11-20 · Red Hat rating ModerateSubmariner v0.21 security fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9
- RHSA-2025:21775 Released 2025-11-19 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/gateway-rhel9, registry.redhat.io/ansible-automation-platform-26/receptor-rhel9
- RHSA-2025:21768 Released 2025-11-19 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-server-2.6.20251119-1.el9ap, receptor-1.6.2-2.el9ap, receptorctl-1.6.2-2.el9ap
- RHSA-2025:21706 Released 2025-11-18 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor-1.6.2-1.el8ap, receptorctl-1.6.2-1.el8ap
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor-1.6.2-1.el9ap, receptorctl-1.6.2-1.el9ap
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 | Fixed | RHSA-2026:36873 |
| Red Hat Advanced Cluster Management for Kubernetes 2.14 | Fixed | RHSA-2025:21892 |
| Red Hat Advanced Cluster Management for Kubernetes 2.15 | Fixed | RHSA-2025:22784 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2025:21706 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2025:21706 |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2025:23131 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2025:23069 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2025:23069 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2025:21775 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | Fixed | RHSA-2025:21768 |
Not affected: 15 products
- OpenShift Service Mesh 3
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Management for Kubernetes 2.13
- Red Hat Advanced Cluster Management for Kubernetes 2.14
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Connectivity Link 1
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59530
- 2026-10-03 Alias added: GHSA-47m2-4cr7-mhcw
References
Other 7
- https://github.com/quic-go/quic-go/security/advisories/GHSA-47m2-4cr7-mhcw
- https://github.com/quic-go/quic-go/pull/5354
- https://github.com/quic-go/quic-go/blob/v0.55.0/connection.go#L2682-L2685
- https://github.com/quic-go/quic-go/commit/bc5bccf10fd02728eef150683eb4dfaa5c0e749c
- https://github.com/quic-go/quic-go/commit/ce7c9ea8834b9d2ed79efa9269467f02c0895d42
- https://github.com/quic-go/quic-go
- https://pkg.go.dev/vuln/GO-2025-4017
More quic-go vulnerabilities
- TI-2024-14782 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack CVSS 3.1HIGH 7.5
- TI-2023-24866 quic-go vulnerable to pointer dereference that can lead to panic CVSS 3.1HIGH 7.5
- TI-2026-29554 quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion CVSS 3.1HIGH 7.5
- TI-2026-17320 webtransport-go CloseWithError can block indefinitely CVSS 3.1HIGH 7.5
- TI-2026-17319 webtransport-go affected by Memory Exhaustion Attack due to Missing Length Check in WT_CLOSE_SESSION Capsule CVSS 3.1HIGH 7.5
- TI-2025-21196 quic-go Has Panic in Path Probe Loss Recovery Handling CVSS 3.1HIGH 7.5
Sources
- CVE-2025-59530 · CVE Program
- CVE-2025-59530 · NVD
- FIRST EPSS
- GHSA-47m2-4cr7-mhcw · GitHub Advisory Database · CC BY 4.0
- CVE-2025-59530 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences